# cve.now: Wpwax

The newest entries naming Wpwax as an affected vendor (up to 200), of 46 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-122661](https://cve.now/CVE-2026-122661.md): WordPress Directorist plugin \<= 8.10.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-119497](https://cve.now/CVE-2026-119497.md): WordPress Directorist plugin \<= 8.10.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-100185](https://cve.now/CVE-2026-100185.md): Directorist: AI-Powered Business Directory, Listings & Classified Ads \<= 8.10.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'phone' Listing Field (CVSS 6.4)
- [CVE-2026-17092](https://cve.now/CVE-2026-17092.md): Directorist: AI-Powered Business Directory, Listings & Classified Ads \<= 8.10.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Listing Deletion via 'listing\_id' Parameter (CVSS 8.1)
- [CVE-2026-94499](https://cve.now/CVE-2026-94499.md): WordPress FormGent plugin \<= 1.12.2 - Broken Access Control vulnerability (CVSS 7.1)
- [CVE-2026-32474](https://cve.now/CVE-2026-32474.md): WordPress Templatiq plugin \<= 0.2.5 - Arbitrary File Upload vulnerability (CVSS 9.9)
- [CVE-2025-15028](https://cve.now/CVE-2025-15028.md): FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More \<= 1.9.2 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2)
- [CVE-2026-3141](https://cve.now/CVE-2026-3141.md): FormGent \<= 1.9.2- Missing Authorization to Unauthenticated Arbitrary File Deletion via 'file\_token' Parameter (CVSS 9.1)
- [CVE-2026-59518](https://cve.now/CVE-2026-59518.md): WordPress Directorist plugin \<= 8.8.2 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2026-49073](https://cve.now/CVE-2026-49073.md): WordPress Directorist Booking plugin \<= 3.0.3 - SQL Injection vulnerability (CVSS 8.5)
- [CVE-2026-39509](https://cve.now/CVE-2026-39509.md): WordPress Directorist plugin \<= 8.5.10 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-22460](https://cve.now/CVE-2026-22460.md): WordPress FormGent plugin \<= 1.7.0 - Arbitrary File Deletion vulnerability (CVSS 8.6)
- [CVE-2025-68069](https://cve.now/CVE-2025-68069.md): WordPress Directorist plugin \<= 8.6.6 - Broken Access Control vulnerability (CVSS 7.1)
- [CVE-2025-64250](https://cve.now/CVE-2025-64250.md): WordPress Directorist plugin \<= 8.6.6 - Open Redirection vulnerability (CVSS 4.7)
- [CVE-2025-66077](https://cve.now/CVE-2025-66077.md): WordPress Legal Pages plugin \<= 1.4.6 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2025-12174](https://cve.now/CVE-2025-12174.md): Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings \<= 8.5.2 - Missing Authorization to Authenticated (Subscriber+) Data Export and Slug Update (CVSS 6.5)
- [CVE-2025-10488](https://cve.now/CVE-2025-10488.md): Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings \<= 8.4.8 - Authenticated (Subscriber+) Arbitrary File Move (CVSS 8.1)
- [CVE-2025-48242](https://cve.now/CVE-2025-48242.md): WordPress Legal Pages plugin \<= 1.4.5 - Broken Access Control Vulnerability (CVSS 6.5)
- [CVE-2025-32658](https://cve.now/CVE-2025-32658.md): WordPress HelpGent plugin \<= 2.2.5 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2025-39525](https://cve.now/CVE-2025-39525.md): WordPress Logo Carousel Slider plugin \<= 2.1.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- [CVE-2025-32499](https://cve.now/CVE-2025-32499.md): WordPress Logo Showcase Ultimate plugin \<= 1.4.4 - Local File Inclusion vulnerability (CVSS 6.5)
- [CVE-2025-31857](https://cve.now/CVE-2025-31857.md): WordPress Directorist AddonsKit for Elementor plugin \<= 1.1.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-2224](https://cve.now/CVE-2025-2224.md): Directorist \<= 8.2 - Missing Authorization to Unauthenticated Arbitrary Post Publishing (CVSS 5.3)
- [CVE-2025-1570](https://cve.now/CVE-2025-1570.md): Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings \<= 8.1 - Privilege Escalation and Account Takeover via Weak OTP (CVSS 8.1)
- [CVE-2024-12041](https://cve.now/CVE-2024-12041.md): Directorist – AI-Powered WordPress Business Directory Plugin with Classified Ads Listings \<= 8.0.12 - Unauthenticated User Information Exposure (CVSS 5.3)
- [CVE-2025-24782](https://cve.now/CVE-2025-24782.md): WordPress Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin \<= 1.6.10 - Local File Inclusion vulnerability (CVSS 6.5)
- [CVE-2025-24681](https://cve.now/CVE-2025-24681.md): WordPress Product Carousel Slider & Grid Ultimate for WooCommerce Plugin \<= 1.10.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2024-13408](https://cve.now/CVE-2024-13408.md): Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget \<= 1.6.10 - Authenticated (Contributor+) Local File Inclusion (CVSS 7.5)
- [CVE-2024-13409](https://cve.now/CVE-2024-13409.md): Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget \<= 1.6.10 - Authenticated (Contributor+) Local File Inclusion via post\_type\_ajax\_handler() (CVSS 7.5)
- [CVE-2024-12040](https://cve.now/CVE-2024-12040.md): Product Carousel Slider & Grid Ultimate for WooCommerce \<= 1.9.10 - Authenticated (Contributor+) Local File Inclusion via 'theme' (CVSS 8.8)
- [CVE-2024-44048](https://cve.now/CVE-2024-44048.md): WordPress Product Carousel Slider & Grid Ultimate for WooCommerce plugin \<= 1.9.10 - Authenticated Local File Inclusion vulnerability (CVSS 6.5)
- [CVE-2024-8046](https://cve.now/CVE-2024-8046.md): Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid \<= 1.4.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4)
- [CVE-2024-33929](https://cve.now/CVE-2024-33929.md): WordPress Directorist plugin \<= 7.8.6 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2024-32451](https://cve.now/CVE-2024-32451.md): WordPress Legal Pages plugin \<= 1.4.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2024-29925](https://cve.now/CVE-2024-29925.md): WordPress Post Grid, Slider & Carousel Ultimate plugin \<= 1.6.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2023-50886](https://cve.now/CVE-2023-50886.md): WordPress Legal Pages plugin \<= 1.3.7 - CSRF + Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2024-1950](https://cve.now/CVE-2024-1950.md): Product Carousel Slider & Grid Ultimate for WooCommerce \<= 1.9.7 - Authenticated(Contributor+) PHP Object Injection (CVSS 7.5)
- [CVE-2024-1951](https://cve.now/CVE-2024-1951.md): Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid \<= 1.3.8 - Authenticated(Contributor+) PHP Object Injection (CVSS 7.5)
- [CVE-2024-2006](https://cve.now/CVE-2024-2006.md): Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget \<= 1.6.7 - Authenticated (Contributor+) PHP Object Injection in outpost\_shortcode\_metabox\_markup (CVSS 8.8)
- [CVE-2024-1322](https://cve.now/CVE-2024-1322.md): Directorist \<= 7.8.4 - Missing Authorization to Unauthenticated Settings Change (CVSS 5.3)
- [CVE-2023-47824](https://cve.now/CVE-2023-47824.md): WordPress Legal Pages Plugin \<= 1.3.8 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4)
- [CVE-2023-41798](https://cve.now/CVE-2023-41798.md): WordPress Directorist Plugin \<= 7.7.1 is vulnerable to CSV Injection (CVSS 5.1)
- [CVE-2023-1889](https://cve.now/CVE-2023-1889.md): Directorist \<= 7.5.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Deletion in listing\_task (CVSS 6.5)
- [CVE-2023-1888](https://cve.now/CVE-2023-1888.md): Directorist \<= 7.5.4 - Authenticated (Subscriber+) Arbitrary User Password Reset to Privilege Escalation (CVSS 8.8)
- [CVE-2022-34650](https://cve.now/CVE-2022-34650.md): WordPress Team plugin \<= 1.2.6 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities (CVSS 4.1)
- [CVE-2022-34853](https://cve.now/CVE-2022-34853.md): WordPress Team plugin \<= 1.2.6 - Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities (CVSS 4.1)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/wpwax
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.